How to Use Azure OpenAI with the GitHub Copilot SDK in a C# Application

This interface separates the rest of the application from the specific AI implementation.

You could implement it using a supported Copilot SDK integration or an Azure OpenAI client. The application can then change its implementation without requiring every controller or business service to know the details of model communication.

This abstraction is especially useful when the application needs to support multiple providers or when provider-specific capabilities differ.

Call Azure OpenAI from a C# Application

If the selected Copilot SDK version does not provide a supported Azure OpenAI provider integration, you can still call Azure OpenAI directly from C#.

The following example demonstrates the general structure of an HTTP request to an Azure OpenAI chat completions endpoint. It is an independent Azure OpenAI integration, not a Copilot SDK call.

using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;

var endpoint = Environment.GetEnvironmentVariable(
    "AZURE_OPENAI_ENDPOINT");

var deployment = Environment.GetEnvironmentVariable(
    "AZURE_OPENAI_DEPLOYMENT");

var apiKey = Environment.GetEnvironmentVariable(
    "AZURE_OPENAI_API_KEY");

if (string.IsNullOrWhiteSpace(endpoint) ||
    string.IsNullOrWhiteSpace(deployment) ||
    string.IsNullOrWhiteSpace(apiKey))
{
    throw new InvalidOperationException(
        "Azure OpenAI configuration is incomplete.");
}

using var client = new HttpClient
{
    Timeout = TimeSpan.FromSeconds(60)
};

client.DefaultRequestHeaders.Add(
    "api-key",
    apiKey);

var requestBody = new
{
    messages = new[]
    {
        new
        {
            role = "system",
            content = "You are a helpful C# programming assistant."
        },
        new
        {
            role = "user",
            content = "Explain dependency injection in C#."
        }
    }
};

var json = JsonSerializer.Serialize(requestBody);

var url =
    $"{endpoint.TrimEnd('/')}/openai/deployments/" +
    $"{Uri.EscapeDataString(deployment)}/chat/completions" +
    "?api-version=<supported-api-version>";

using var content = new StringContent(
    json,
    Encoding.UTF8,
    "application/json");

using var response = await client.PostAsync(
    url,
    content);

var responseBody = await response.Content.ReadAsStringAsync();

response.EnsureSuccessStatusCode();

Console.WriteLine(responseBody);

Before running this example, replace the API version placeholder with a version supported by your Azure OpenAI resource and selected endpoint.

The example uses an API key to keep the HTTP request straightforward. A production application using Microsoft Entra ID should instead obtain and attach an appropriate bearer token through a supported authentication library.

The request includes system and user messages. The system message describes the assistant's role, while the user message contains the question.

The application serializes the request as JSON, sends it to the selected deployment, and reads the response.

For a production implementation, deserialize the response into a defined model instead of returning raw JSON. Also consider connection reuse through IHttpClientFactory, cancellation, bounded retries, response-size limits, and structured error handling.

Handle Errors and Rate Limits

AI services can return errors because of authentication failures, invalid deployment names, unsupported API versions, request limits, temporary service failures, or malformed requests.

A production client should distinguish between these conditions.

Do not automatically retry every failure. Authentication and validation errors generally require configuration or request changes, while some temporary failures may be suitable for a bounded retry policy.

Also avoid logging API keys, bearer tokens, sensitive prompts, or complete model responses when they may contain confidential information.

Add AI Functionality to an ASP.NET Core API

Once the model call works in a small application, you can expose the functionality through an ASP.NET Core endpoint.

For example, the application could define an API that accepts a programming question and returns an AI-generated explanation.

using Microsoft.AspNetCore.Mvc;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddHttpClient<AzureAiService>();

var app = builder.Build();

app.MapPost(
    "/api/assistant",
    async (
        AssistantRequest request,
        AzureAiService ai,
        CancellationToken cancellationToken) =>
    {
        if (string.IsNullOrWhiteSpace(request.Question))
        {
            return Results.BadRequest(
                new { error = "A question is required." });
        }

        var answer = await ai.GetResponseAsync(
            request.Question,
            cancellationToken);

        return Results.Ok(new AssistantResponse(answer));
    });

app.Run();

public sealed record AssistantRequest(string Question);

public sealed record AssistantResponse(string Answer);

This example illustrates the endpoint structure, but it requires an AzureAiService implementation with the GetResponseAsync method. That service should contain the Azure OpenAI client configuration, request serialization, authentication, and response parsing.

In production, add request-size limits, authentication, authorization, rate limiting, and appropriate error handling. An unauthenticated AI endpoint can be abused to generate excessive model usage and unexpected costs.

If the application also uses Copilot SDK features, keep those responsibilities behind separate services unless there is a clear reason to combine them.

Best Practices for Production

Keep Credentials Out of Source Control

Use a secret store, managed identity, or another supported secure credential mechanism. Never commit API keys or access tokens.

Set Usage Limits

Configure request limits and monitor model consumption. Validate user input and avoid allowing clients to submit arbitrarily large prompts.

Separate Provider-Specific Code

Use interfaces and dependency injection to isolate model communication. This makes testing easier and reduces the impact of provider-specific changes.

Monitor Latency and Failures

Record request duration, status codes, and usage information where available. Avoid recording sensitive content unnecessarily.

Test Authentication and Failure Scenarios

Test expired credentials, missing configuration, rate limits, timeouts, and unavailable services. A successful response from the model is only one part of the application's behavior.

Common Mistakes to Avoid

One common mistake is assuming that Azure OpenAI can be configured as a Copilot SDK provider without checking whether the selected SDK version supports it.

Another is confusing GitHub authentication with Azure authentication. These are separate access-control systems with different credentials and permissions.

Hard-coding API keys is also dangerous because credentials can leak through source control, build logs, or diagnostic output.

Finally, avoid treating model output as trusted application data. Validate generated content before using it in database operations, executing commands, or making security-sensitive decisions.

Advantages and Limitations

Combining Copilot capabilities with Azure OpenAI can provide flexibility when an application needs both agent-oriented workflows and Azure-hosted model access.

Azure OpenAI offers centralized resource management and integration with Azure identity and security controls. A provider abstraction can also make an application easier to maintain.

However, the integration depends on the supported SDK capabilities and authentication model. Running two separate integrations can increase implementation complexity, and model access introduces latency, usage costs, and output variability.

The architecture should therefore be based on the actual capabilities required by the application rather than assuming that every SDK and model provider can be connected directly.

Summary

Using Azure OpenAI with the GitHub Copilot SDK in a C# application begins with verifying the supported integration model. The Copilot SDK and Azure OpenAI have different responsibilities, and their authentication and configuration requirements must be handled separately.

Prepare the development environment, configure the Azure resource securely, and confirm whether the selected SDK supports Azure OpenAI directly. If it does not, use a documented extension point or implement a separate Azure OpenAI client.

Finally, isolate AI communication behind a service interface, handle errors and rate limits, protect credentials, and validate generated output before using it in business-critical operations.

This approach provides a maintainable foundation for integrating AI into C# applications without relying on unsupported provider configurations.